Hi,

I'd like to audit on a W2000 workstation if an application
was used - opening and closing time.

I know it's possible to audit a service this way.

how can I do the same with an app?

Thanks

Sebastien

You can enable auditing of object access and then set auditing of the executable
in properties/security/advanced/auditing/execute file. However that may not give
you a closing time - you will need to test it out, and try to use minimum amount
of groups or users to audit instead of everyone to keep events generated down.
You could also enable auditing of process tracking, however that will generate
huge amounts of events in your security log for that computer. You also will
want to substantially increase the size of the security log from default. ---
Steve

"Sebas" <(E-Mail Removed)> wrote in message
news:eW$(E-Mail Removed)...
> Hi,
>
> I'd like to audit on a W2000 workstation if an application
> was used - opening and closing time.
>
> I know it's possible to audit a service this way.
>
> how can I do the same with an app?
>
> Thanks
>
> Sebastien
>
>

Hi,

Thanks for your tips, but I've already tryied all that. The execute file
auditing doesn't give a closing time, and the process tracking gives way to
much information!

I'm all ears if you have another suggestion!!

Take Care!

Sebas


"Steven Umbach" <(E-Mail Removed)> a écrit dans le message de
news:vR%9b.490117$uu5.83433@sccrnsc04...
> You can enable auditing of object access and then set auditing of the
executable
> in properties/security/advanced/auditing/execute file. However that may
not give
> you a closing time - you will need to test it out, and try to use minimum
amount
> of groups or users to audit instead of everyone to keep events generated
down.
> You could also enable auditing of process tracking, however that will
generate
> huge amounts of events in your security log for that computer. You also
will
> want to substantially increase the size of the security log from
default. ---
> Steve
>
> "Sebas" <(E-Mail Removed)> wrote in message
> news:eW$(E-Mail Removed)...
> > Hi,
> >
> > I'd like to audit on a W2000 workstation if an application
> > was used - opening and closing time.
> >
> > I know it's possible to audit a service this way.
> >
> > how can I do the same with an app?
> >
> > Thanks
> >
> > Sebastien
> >
> >
>
>

That's about the only thing I could think of. --- Steve

"Sebas" <(E-Mail Removed)> wrote in message
news:%(E-Mail Removed)...
> Hi,
>
> Thanks for your tips, but I've already tryied all that. The execute file
> auditing doesn't give a closing time, and the process tracking gives way to
> much information!
>
> I'm all ears if you have another suggestion!!
>
> Take Care!
>
> Sebas
>
>
> "Steven Umbach" <(E-Mail Removed)> a écrit dans le message de
> news:vR%9b.490117$uu5.83433@sccrnsc04...
> > You can enable auditing of object access and then set auditing of the
> executable
> > in properties/security/advanced/auditing/execute file. However that may
> not give
> > you a closing time - you will need to test it out, and try to use minimum
> amount
> > of groups or users to audit instead of everyone to keep events generated
> down.
> > You could also enable auditing of process tracking, however that will
> generate
> > huge amounts of events in your security log for that computer. You also
> will
> > want to substantially increase the size of the security log from
> default. ---
> > Steve
> >
> > "Sebas" <(E-Mail Removed)> wrote in message
> > news:eW$(E-Mail Removed)...
> > > Hi,
> > >
> > > I'd like to audit on a W2000 workstation if an application
> > > was used - opening and closing time.
> > >
> > > I know it's possible to audit a service this way.
> > >
> > > how can I do the same with an app?
> > >
> > > Thanks
> > >
> > > Sebastien
> > >
> > >
> >
> >
>
>